@thebassclef/lite 1.9.8 → 1.9.10

package/README.md

@@ -1,6 +1,10 @@
 # @thebassclef/lite
 
-Install bassclef in your project. Two commands.
+**Security posture.** @thebassclef/lite ships with zero install-time scripts, SLSA v1 build provenance, Apache-2.0 license, and zero runtime dependencies. The CLI writes to `~/.claude` and `$CLAUDE_PROJECT_DIR` at runtime, not at install. See [SECURITY.md](SECURITY.md) for disclosure.
+
+## Install
+
+Two commands.
 
 ```bash
 npm install -g @thebassclef/lite
@@ -63,7 +67,7 @@ your browser.
 
 ## Current release
 
-<!-- version-start -->1.9.8<!-- version-end -->
+<!-- version-start -->1.9.10<!-- version-end -->
 
 See [CHANGELOG.md](CHANGELOG.md) for the full changelog. Adopter-facing
 release notes live at [docs.bassclef.dev/docs/whats-new/releases](https://docs.bassclef.dev/docs/whats-new/releases).

package/dist/index.cjs

@@ -1,4 +1,4 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const version = "1.9.8";
+const version = "1.9.10";
 exports.version = version;

package/dist/index.d.ts

@@ -1,2 +1,2 @@
-export declare const version: "1.9.8";
+export declare const version: "1.9.10";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,4 +1,4 @@
-const version = "1.9.8";
+const version = "1.9.10";
 export {
   version
 };

package/dist/lite/.claude/hooks/git-stash-u-guard.sh

@@ -50,7 +50,10 @@ if ! echo "$CMD" | grep -qE '(^|[[:space:]])git[[:space:]]+stash([[:space:]]+pus
 fi
 
 # --- Override — SKIP_GIT_STASH_U_GUARD=1 bypasses (logged) ---
-if [ "${SKIP_GIT_STASH_U_GUARD:-0}" = "1" ]; then
+# Honors inline SKIP per #2036 Finding #4 (recipe must reach the hook).
+# shellcheck source=/dev/null
+source "${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}/lib/skip-env-inline-check.sh" 2>/dev/null || true
+if declare -F skip_var_set >/dev/null && skip_var_set "SKIP_GIT_STASH_U_GUARD" "$CMD"; then
   TRACE_LOG="${BASSCLEF_TRACE_LOG:-${BASSCLEF_TRACE_FILE:-$HOME/.claude/state/trace.log}}"
   mkdir -p "$(dirname "$TRACE_LOG")" 2>/dev/null || true
   echo "$(date -u +%FT%TZ) SKIP_GIT_STASH_U_GUARD $CMD" >> "$TRACE_LOG" 2>/dev/null || true

package/dist/lite/.claude/hooks/post-skill-friction-check.sh

@@ -45,7 +45,12 @@ SKILL_NAME=$(jq <<< "$TOOL_INPUT" -r '.skill // ""' 2>/dev/null)
 
 # Major composer skills — these chain other skills or do heavy work.
 # Friction surfaces best at their boundaries.
-MAJOR_SKILLS_PATTERN="^(preview|preview-build|build|shape|longrun|decompose|spec|architect-review|frontend-design|prototype-variants|prototype-gallery|interpret-input|objectory-decompose|ux-migration|ia-model|interaction-design|use-case|user-stories|jtbd-tasks|task-scenarios)$"
+# Per ADR-040 D1 vocabulary rename (grace window through 2026-10-31 per
+# .claude/rules/we-dont-break-adopters.md): new names stage/launch added;
+# old names preview/preview-build preserved for grace-window compat.
+# Fix for bassclef-upstream#1777 (friction log never created because current
+# vocabulary skipped the gate).
+MAJOR_SKILLS_PATTERN="^(preview|preview-build|stage|launch|build|shape|longrun|decompose|spec|architect-review|frontend-design|prototype-variants|prototype-gallery|interpret-input|objectory-decompose|ux-migration|ia-model|interaction-design|use-case|user-stories|jtbd-tasks|task-scenarios)$"
 
 if ! echo "$SKILL_NAME" | grep -qE "$MAJOR_SKILLS_PATTERN"; then
   exit 0

package/dist/lite/.claude/hooks/pre-commit-gate.sh

@@ -41,7 +41,16 @@ trace_log "pre-commit" "git commit"
 # Exempt: rules/hooks/skills/standards/docs/strategy/chronicle/scripts/tests
 # (places where the policy itself is documented or test fixtures live).
 # Override: SKIP_OPERATOR_PATHS=1 git commit  (logged via trace-helper)
-if [ "${SKIP_OPERATOR_PATHS:-0}" != "1" ]; then
+#
+# Env-reach fix per #2036 Finding #4: the inline recipe sets the var in
+# the git subshell env, not the hook env. Source the helper lib so the
+# recipe reaches the check reliably across harness setups.
+# shellcheck source=/dev/null
+source "${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}/lib/skip-env-inline-check.sh" 2>/dev/null || true
+if declare -F skip_var_set >/dev/null && skip_var_set "SKIP_OPERATOR_PATHS" "$COMMAND"; then
+  # Override honored; skip the check.
+  :
+else
   STAGED_NONEXEMPT=$(git diff --cached --name-only --diff-filter=AM 2>/dev/null | \
     grep -vE '^\.claude/(rules|hooks|skills|luminaries|agents)/' | \
     grep -vE '^standards/' | \
@@ -50,7 +59,8 @@ if [ "${SKIP_OPERATOR_PATHS:-0}" != "1" ]; then
     grep -vE '^docs/' | \
     grep -vE '^chronicle/' | \
     grep -vE '^strategy/' | \
-    grep -vE '^scripts/tests/' || true)
+    grep -vE '^scripts/tests/' | \
+    grep -vE '^lib/tests/' || true)
   if [ -n "$STAGED_NONEXEMPT" ]; then
     LEAKED=""
     while IFS= read -r f; do
@@ -110,7 +120,8 @@ fi
 # fast-fail layer per Saltzer-Schroeder complete mediation.
 #
 # Override: SKIP_COLD_ADOPTER_HARNESS=1 git commit (logged via trace-helper)
-if [ "${SKIP_COLD_ADOPTER_HARNESS:-0}" != "1" ]; then
+# Env-reach via skip_var_set helper per #2036 Finding #4.
+if ! { declare -F skip_var_set >/dev/null && skip_var_set "SKIP_COLD_ADOPTER_HARNESS" "$COMMAND"; }; then
   # The 12-pattern matcher mirrors .claude/rules/cold-adopter-harness-discipline.md
   # § "When this rule fires". Keep these patterns in sync; a future WU may
   # centralize the list via a sourced library function.
@@ -173,7 +184,8 @@ fi
 #   state/markers/lead-lens-signoff/<branch-slug>.marker
 # Discipline lives in .claude/rules/loop-discipline.md Step 0.5 + 2a + 5.5.
 # Override: SKIP_LEAD_LENS_SIGNOFF=1 git commit (logged via trace-helper)
-if [ "${SKIP_LEAD_LENS_SIGNOFF:-0}" != "1" ]; then
+# Env-reach via skip_var_set helper per #2036 Finding #4.
+if ! { declare -F skip_var_set >/dev/null && skip_var_set "SKIP_LEAD_LENS_SIGNOFF" "$COMMAND"; }; then
   # Reuse the substrate-affecting matcher shape from cold-adopter fast-path.
   STAGED_SUBSTRATE_LL=$(git diff --cached --name-only --diff-filter=AM 2>/dev/null | grep -E \
     -e '^\.claude/hooks/[^/]+\.sh$' \
@@ -189,6 +201,37 @@ if [ "${SKIP_LEAD_LENS_SIGNOFF:-0}" != "1" ]; then
     -e '^\.github/workflows/bassclef-.*\.yml$' \
     -e '^scripts/[^/]+\.sh$' \
     || true)
+  # Install-written-paths filter per bassclef-upstream#2036 Finding #8 (Kunal).
+  # Rule: .claude/rules/install-written-paths-mediation.md
+  # Any staged substrate path registered as install-written AND unchanged since
+  # install is dropped from the author-edit set. Lead-lens gate fires only on
+  # author-edited substrate paths.
+  if [ -n "$STAGED_SUBSTRATE_LL" ]; then
+    IWP_LIB=""
+    if [ -f "lib/install-written-paths.sh" ]; then
+      IWP_LIB="lib/install-written-paths.sh"
+    elif [ -f "$BASSCLEF_DIR/lib/install-written-paths.sh" ]; then
+      IWP_LIB="$BASSCLEF_DIR/lib/install-written-paths.sh"
+    fi
+    if [ -n "$IWP_LIB" ]; then
+      # shellcheck source=/dev/null
+      . "$IWP_LIB" 2>/dev/null || true
+      if declare -F is_install_written_path >/dev/null 2>&1; then
+        FILTERED_LL=""
+        while IFS= read -r _iwp_f; do
+          [ -z "$_iwp_f" ] && continue
+          if is_install_written_path "$_iwp_f" 2>/dev/null; then
+            trace_log "pre-commit" "lead-lens skip install-written path=$_iwp_f"
+            continue
+          fi
+          FILTERED_LL="${FILTERED_LL}${FILTERED_LL:+$'\n'}$_iwp_f"
+        done <<EOF
+$STAGED_SUBSTRATE_LL
+EOF
+        STAGED_SUBSTRATE_LL="$FILTERED_LL"
+      fi
+    fi
+  fi
   if [ -n "$STAGED_SUBSTRATE_LL" ]; then
     LL_BRANCH_SLUG=$(git branch --show-current 2>/dev/null | tr '/' '-')
     PREM_M="state/markers/pre-mortem/${LL_BRANCH_SLUG}.marker"
@@ -305,7 +348,7 @@ fi
 
 # --- Reserved skill names check (collision with Claude Code built-ins) ---
 # See .claude/rules/reserved-skill-names.md + standards/reserved-skill-names.md
-if [ "${SKIP_RESERVED_NAMES:-0}" != "1" ]; then
+if ! { declare -F skip_var_set >/dev/null && skip_var_set "SKIP_RESERVED_NAMES" "$COMMAND"; }; then
   STAGED_NEW_SKILLS=$(git diff --cached --name-only --diff-filter=A -- '.claude/skills/*/SKILL.md' 2>/dev/null || true)
   if [ -n "$STAGED_NEW_SKILLS" ]; then
     # Extract reserved names from the standards table (Name column values inside backticks)
@@ -351,7 +394,7 @@ fi
 # counter, silencing the compliance signal (the failure mode that motivated
 # this gate). Block commits to chronicle/*.md or docs/chronicle/*.md that
 # lack the section. Override: SKIP_CHRONICLE_GATE_EVIDENCE=1 git commit.
-if [ "${SKIP_CHRONICLE_GATE_EVIDENCE:-0}" != "1" ]; then
+if ! { declare -F skip_var_set >/dev/null && skip_var_set "SKIP_CHRONICLE_GATE_EVIDENCE" "$COMMAND"; }; then
   STAGED_CHRONICLES=$(git diff --cached --name-only --diff-filter=AM -- 'chronicle/*.md' 'docs/chronicle/*.md' 2>/dev/null || true)
   # Source spine accessor library when available — preferred frontmatter
   # check route per state-spine-contract.md. Graceful fallback for repos

package/dist/lite/.claude/hooks/pre-commit-identifier-leak-scrub.sh

@@ -33,12 +33,6 @@
 
 set -u
 
-# Override path — logged via trace-helper per bassclef discipline
-if [ "${SKIP_IDENTIFIER_LEAK_SCRUB:-0}" = "1" ]; then
-  echo "  identifier-leak-scrub: SKIP_IDENTIFIER_LEAK_SCRUB=1 — bypassing scrub" >&2
-  exit 0
-fi
-
 # R-N1 fail-soft: if grep is unavailable, warn to stderr and exit 0
 if ! command -v grep >/dev/null 2>&1; then
   echo "  identifier-leak-scrub: warn — grep unavailable; skipping scrub" >&2
@@ -59,6 +53,16 @@ else
   COMMAND=$(echo "$INPUT" | grep -oE '"command"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/^"command"[[:space:]]*:[[:space:]]*"//' | sed 's/"$//')
 fi
 
+# Override path — honors inline SKIP_FOO=1 cmd per #2036 Finding #4.
+# PreToolUse hooks run in Claude Code's env, not the git subshell env.
+# The helper lib parses $COMMAND for the inline prefix + falls back to env.
+# shellcheck source=/dev/null
+source "${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}/lib/skip-env-inline-check.sh" 2>/dev/null || true
+if declare -F skip_var_set >/dev/null && skip_var_set "SKIP_IDENTIFIER_LEAK_SCRUB" "$COMMAND"; then
+  echo "  identifier-leak-scrub: SKIP_IDENTIFIER_LEAK_SCRUB=1 — bypassing scrub" >&2
+  exit 0
+fi
+
 # Pass through non-git-commit commands
 if ! echo "$COMMAND" | grep -qE '^[[:space:]]*git[[:space:]]+commit'; then
   exit 0
@@ -93,8 +97,36 @@ fi
 # Filter to '+' lines only so a commit that REMOVES a pre-existing leak
 # does not trip on the removed-content line. `+++` file headers stripped.
 # Per sunj-labs/bassclef-upstream#1575.
+#
+# Self-exclude per sunj-labs/bassclef-cli#305: the hook, its test, the
+# rule, and the pattern-source file all carry pattern-looking strings
+# as documentation. Scanning them blocks the first commit after a fresh
+# bassclef init and teaches adopters to skip the check on day one.
+# Non-self paths with the same patterns STILL block (Test 19).
+SELF_EXCLUDE_PATHS=(
+  ".claude/hooks/pre-commit-identifier-leak-scrub.sh"
+  ".claude/hooks/tests/pre-commit-identifier-leak-scrub.test.sh"
+  ".claude/rules/identifier-leak-prevention.md"
+  "standards/identifier-leak-patterns.txt"
+)
 if [ -z "$BLOCK_REASON" ]; then
-  STAGED_DIFF=$(git diff --cached 2>/dev/null | grep '^+' | grep -v '^+++' || echo "")
+  STAGED_FILES=$(git diff --cached --name-only 2>/dev/null || echo "")
+  STAGED_DIFF=""
+  while IFS= read -r file; do
+    [ -z "$file" ] && continue
+    skip=0
+    for sp in "${SELF_EXCLUDE_PATHS[@]}"; do
+      if [ "$file" = "$sp" ]; then
+        skip=1
+        break
+      fi
+    done
+    [ "$skip" = "1" ] && continue
+    file_diff=$(git diff --cached -- "$file" 2>/dev/null | grep '^+' | grep -v '^+++' || echo "")
+    if [ -n "$file_diff" ]; then
+      STAGED_DIFF+="$file_diff"$'\n'
+    fi
+  done <<< "$STAGED_FILES"
   if [ -n "$STAGED_DIFF" ]; then
     MATCH=$(echo "$STAGED_DIFF" | grep -oE "$IDENTIFIER_PATTERNS" | head -1)
     if [ -n "$MATCH" ]; then
@@ -104,6 +136,29 @@ if [ -z "$BLOCK_REASON" ]; then
   fi
 fi
 
+# Check 3 — git author identity (per sunj-labs/bassclef-cli#305)
+# On a Mac without user.email set, git builds the author from username +
+# hostname (e.g., `<user>@<host>.local`). The address ships in every commit.
+# Scan GIT_AUTHOR_IDENT against the pattern set plus the `.local` suffix.
+# Fail-soft when git is missing or the ident cannot be resolved.
+if [ -z "$BLOCK_REASON" ] && command -v git >/dev/null 2>&1; then
+  AUTHOR_IDENT=$(git var GIT_AUTHOR_IDENT 2>/dev/null || true)
+  if [ -n "$AUTHOR_IDENT" ]; then
+    # Format: "Name <email> timestamp timezone"
+    AUTHOR_EMAIL=$(echo "$AUTHOR_IDENT" | grep -oE '<[^>]+>' | tr -d '<>')
+    if [ -n "$AUTHOR_EMAIL" ]; then
+      MATCH=$(echo "$AUTHOR_EMAIL" | grep -oE "$IDENTIFIER_PATTERNS" | head -1)
+      if [ -z "$MATCH" ] && echo "$AUTHOR_EMAIL" | grep -qE '\.local$'; then
+        MATCH="$AUTHOR_EMAIL"
+      fi
+      if [ -n "$MATCH" ]; then
+        BLOCK_REASON="commit author"
+        BLOCK_MATCH="$MATCH"
+      fi
+    fi
+  fi
+fi
+
 # BLOCK if any pattern matched
 if [ -n "$BLOCK_REASON" ]; then
   cat >&2 <<EOF
@@ -124,7 +179,12 @@ Resolution paths:
   1. Rewrite the commit message or staged content to drop the identifier
      - Replace machine names with placeholders like <machine> or the branch
      - Replace absolute paths with relative paths or \$HOME references
-  2. Override (rare — for legitimate cases like DON'T-do-this documentation):
+  2. If the match is in your commit author identity:
+     - Set a stable identity: git config --global user.email \\
+         <username>@users.noreply.github.com
+     - And: git config --global user.name "<Your Name>"
+     - Then retry the commit; the author will no longer include the host.
+  3. Override (rare — for legitimate cases like DON'T-do-this documentation):
      SKIP_IDENTIFIER_LEAK_SCRUB=1 git commit ...
 
 See .claude/rules/identifier-leak-prevention.md for full discipline.

package/dist/lite/.claude/hooks/pre-commit-manifest-autoregen.sh

@@ -38,8 +38,10 @@ if ! echo "$COMMAND" | grep -q 'git commit'; then
   exit 0
 fi
 
-# Override path
-if [ "${SKIP_MANIFEST_AUTOREGEN:-0}" = "1" ]; then
+# Override path — honors inline SKIP_FOO=1 cmd per #2036 Finding #4.
+# shellcheck source=/dev/null
+source "${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}/lib/skip-env-inline-check.sh" 2>/dev/null || true
+if declare -F skip_var_set >/dev/null && skip_var_set "SKIP_MANIFEST_AUTOREGEN" "$COMMAND"; then
   # Best-effort trace log; ignore failure so hook stays exit 0
   if command -v bash >/dev/null 2>&1 && [ -f ".claude/hooks/trace-helper.sh" ]; then
     bash .claude/hooks/trace-helper.sh "skip" "manifest-autoregen" "SKIP_MANIFEST_AUTOREGEN=1" 2>/dev/null || true

package/dist/lite/.claude/hooks/save-state.sh

@@ -216,6 +216,30 @@ if [ -n "$DIRTY" ]; then
   git add 'state/' ':!state/markers' ':!state/markers/**' 2>/dev/null || true
   git add .claude/projects/*/memory/ 2>/dev/null || true
 
+  STAGED=$(git diff --cached --name-only 2>/dev/null)
+  if [ -n "$STAGED" ]; then
+    # Operator-identifier leak check per #2036 Finding #1.
+    # save-state runs `git commit` directly, bypassing the PreToolUse
+    # pre-commit-gate.sh CCF-3 check. Even if CCF-3 fired, its grep
+    # exempts docs/ paths — so docs/sdlc-traces/*.log carrying absolute
+    # /Users/<name>/ paths would still get committed.
+    # Shared lib so this check matches pre-commit-gate CCF-3 shape.
+    REPO_ROOT_FOR_LIB="$(git rev-parse --show-toplevel 2>/dev/null)"
+    LEAK_LIB="${REPO_ROOT_FOR_LIB}/lib/identifier-leak-check.sh"
+    if [ -f "$LEAK_LIB" ]; then
+      # shellcheck source=/dev/null
+      source "$LEAK_LIB"
+      if ! check_staged_for_leaks; then
+        log "BLOCKED: auto-save detected operator paths in staged content; resetting stage"
+        git reset HEAD -- . 2>/dev/null || true
+        # Fall through — SESSION_LOCK cleanup below still fires, push is skipped
+        # because STAGED check below sees empty stage.
+        STAGED=""
+      fi
+    fi
+  fi
+
+  # Re-check STAGED after possible reset
   STAGED=$(git diff --cached --name-only 2>/dev/null)
   if [ -n "$STAGED" ]; then
     TIMESTAMP=$(date +%Y-%m-%dT%H:%M:%S)

package/dist/lite/.claude/hooks/session-reflection.d/83-install-written-paths-rebuild.sh

@@ -0,0 +1,111 @@
+#!/bin/bash
+# tier: lite
+# install-class: dual
+#
+# Session-start fragment: rebuild install-written-paths manifest when missing/stale.
+# Per bassclef-upstream#2036 Finding #8 (Kunal Slot 1 cure).
+#
+# Walks lite-manifest.json. Registers each shipped file as install-written
+# via the lib. Runs when state/install-written-paths.json is missing OR
+# when any file in lite-manifest is newer than the manifest.
+#
+# Fail-soft per Nygard — logs advisory and continues on error.
+# Override: SKIP_INSTALL_WRITTEN_PATHS_REBUILD=1
+
+# Env-reach safe guard per bassclef-upstream#2036 Finding #4.
+# Fragment is sourced by session-reflection.sh; use return (not exit) so parent survives.
+# shellcheck disable=SC2317
+if [ -n "${SKIP_INSTALL_WRITTEN_PATHS_REBUILD:-}" ]; then
+  return 0 2>/dev/null
+fi
+
+_iwp_fragment_log() {
+  if command -v trace_log >/dev/null 2>&1; then
+    trace_log "install-written-paths-rebuild" "$*"
+  fi
+}
+
+_iwp_fragment_main() {
+  local project_root="${CLAUDE_PROJECT_DIR:-$(pwd)}"
+  local lite_manifest="$project_root/lite-manifest.json"
+  local write_manifest="$project_root/state/install-written-paths.json"
+  local lib="$project_root/lib/install-written-paths.sh"
+
+  # Fallback to BASSCLEF_DIR when CLAUDE_PROJECT_DIR doesn't carry bassclef
+  if [ ! -f "$lite_manifest" ] && [ -n "${BASSCLEF_DIR:-}" ]; then
+    lite_manifest="$BASSCLEF_DIR/lite-manifest.json"
+    lib="$BASSCLEF_DIR/lib/install-written-paths.sh"
+  fi
+
+  # Skip when inputs missing (fail-soft)
+  if [ ! -f "$lib" ]; then
+    _iwp_fragment_log "skip reason=no-lib"
+    return 0
+  fi
+
+  if [ ! -f "$lite_manifest" ]; then
+    _iwp_fragment_log "skip reason=no-lite-manifest"
+    return 0
+  fi
+
+  if ! command -v jq >/dev/null 2>&1; then
+    _iwp_fragment_log "skip reason=no-jq"
+    return 0
+  fi
+
+  # Decide whether to rebuild: missing OR older than lite-manifest
+  local rebuild=0
+  if [ ! -f "$write_manifest" ]; then
+    rebuild=1
+  elif [ "$lite_manifest" -nt "$write_manifest" ]; then
+    rebuild=1
+  fi
+
+  if [ "$rebuild" -eq 0 ]; then
+    _iwp_fragment_log "skip reason=manifest-fresh"
+    return 0
+  fi
+
+  # Source lib — subshell so caller scope stays clean
+  (
+    # shellcheck source=/dev/null
+    . "$lib" 2>/dev/null || exit 0
+
+    if ! declare -F install_written_paths_register >/dev/null 2>&1; then
+      _iwp_fragment_log "skip reason=lib-missing-verb"
+      exit 0
+    fi
+
+    # Reset manifest to empty, then walk lite-manifest entries
+    rm -f "$write_manifest" 2>/dev/null || true
+    install_written_paths_rebuild 2>/dev/null || true
+
+    local registered=0
+    local skipped=0
+
+    # Each lite-manifest entry has .path field — register when file exists on disk
+    while IFS= read -r path; do
+      [ -z "$path" ] && continue
+      local full
+      case "$path" in
+        /*) full="$path" ;;
+        *) full="$project_root/$path" ;;
+      esac
+      if [ -f "$full" ]; then
+        if install_written_paths_register "$path" "bassclef-sync-template" 2>/dev/null; then
+          registered=$((registered + 1))
+        else
+          skipped=$((skipped + 1))
+        fi
+      else
+        skipped=$((skipped + 1))
+      fi
+    done < <(jq -r '.entries[]?.path // empty' "$lite_manifest" 2>/dev/null)
+
+    _iwp_fragment_log "rebuild complete registered=$registered skipped=$skipped"
+  ) || true
+
+  return 0
+}
+
+_iwp_fragment_main

package/dist/lite/.claude/hooks/state-validate.sh

@@ -61,6 +61,14 @@ SCHEMA_DIR="${PROJECT_DIR}/standards/state-spine/schemas"
 
 # If schema dir doesn't exist, this repo doesn't have spine v0 yet — pass through
 if [ ! -d "$SCHEMA_DIR" ]; then
+  # Per cli#316 — honest skip. Previously exited 0 silently; adopters +
+  # agents on lite couldn't tell "validated" from "not checked". /launch
+  # and /objectory-decompose SKILLs promise this hook will BLOCK bad
+  # frontmatter. On lite, where schemas don't ship, this message makes
+  # the skip visible so the promise doesn't lie.
+  if [ "${STATE_VALIDATE_QUIET:-0}" != "1" ]; then
+    echo "state-validate: schemas not available (standards/state-spine/schemas missing at $SCHEMA_DIR); validation skipped at this tier — set STATE_VALIDATE_QUIET=1 to silence" >&2
+  fi
   exit 0
 fi
 

package/dist/lite/.claude/hooks/trace-helper.sh

@@ -5,9 +5,28 @@
 #
 # Usage: source this file, then call:
 #   trace_log "hook-name" "trigger-description"
+#
+# Privacy — relative paths (#2036 Finding #1 — adopter report 2026-10-02):
+# The ${trigger} field can carry filesystem paths from caller args
+# (e.g., $FILE_PATH from PreToolUse hooks). We strip repo-root prefix
+# so adopter traces never leak /Users/<name>/ or /home/<name>/ paths
+# to adopter git. Fallback chain: $CLAUDE_PROJECT_DIR → git rev-parse
+# --show-toplevel → no-strip (silent — trigger lands as-is).
 
 TRACE_DIR="docs/sdlc-traces"
 
+# _trace_repo_root — resolve repo root for prefix-strip.
+# Precondition fallback per @luminary tony-hoare — Hoare R1 risk ledger.
+_trace_repo_root() {
+  if [ -n "${CLAUDE_PROJECT_DIR:-}" ]; then
+    echo "$CLAUDE_PROJECT_DIR"
+    return 0
+  fi
+  local root
+  root=$(git rev-parse --show-toplevel 2>/dev/null) || return 1
+  echo "$root"
+}
+
 trace_log() {
   local hook="$1"
   local trigger="$2"
@@ -17,6 +36,16 @@ trace_log() {
   today=$(date +%Y-%m-%d)
   local log_file="${TRACE_DIR}/${today}.log"
 
+  # Strip repo-root prefix from trigger before writing.
+  # Only strips when root is a non-empty prefix of trigger — leaves
+  # unrelated absolute paths (/opt/anthropic/..., /usr/bin/...) intact.
+  local root
+  root=$(_trace_repo_root 2>/dev/null) || root=""
+  if [ -n "$root" ] && [ "$root" != "/" ]; then
+    trigger="${trigger//$root\//}"
+    trigger="${trigger//$root/}"
+  fi
+
   mkdir -p "$TRACE_DIR" 2>/dev/null || true
   echo "${timestamp} | ${hook} | ${trigger} | — | —" >> "$log_file" 2>/dev/null || true
 }

package/dist/lite/.claude/rules/install-written-paths-mediation.md

@@ -0,0 +1,74 @@
+---
+tier: lite
+---
+
+# Install-Written-Paths — single accessor mediation
+
+Discipline hooks that would fire on files written by install writers (`bassclef init`, `bassclef-sync.sh`, `bassclef-hook-connect`, `schedule-auto-save`, template scripts) MUST consult `lib/install-written-paths.sh` via the single accessor `is_install_written_path <path>` before firing on each staged file.
+
+The lib + manifest ship per bassclef-upstream#2036 Finding #8 (Kunal cold-adopter report, 2026-10-02). Structural cure for Class A (install-leak surfaces).
+
+## When this rule fires
+
+Any discipline hook that currently fires on file content without discriminating install-written from author-edited. Candidate hooks:
+
+- `.claude/hooks/pre-commit-gate.sh` — lead-lens 3-marker gate section (consumer wired per this cure's V1 PR)
+- `.claude/hooks/pre-commit-identifier-leak-scrub.sh` — identifier-leak sister per Kunal #1 (future adopter per R2 risk ledger)
+- Any new discipline hook authored under the loop discipline (`.claude/rules/loop-discipline.md`) that assumes author-edit
+
+## What the rule requires
+
+Before firing discipline on a staged path, each discipline hook:
+
+1. Sources `lib/install-written-paths.sh`.
+2. Calls `is_install_written_path "$staged_path"`.
+3. When return is 0 (true — path is install-written AND content hash matches), SKIP discipline for that path. Emit a trace line via `trace_log` for audit.
+4. When return is 1 (false — path not in manifest OR hash drifted), FIRE discipline as today.
+
+When all staged paths return 0, the hook returns pass without discipline. When at least one returns 1, the hook fires discipline on the author-edited paths.
+
+## Anti-patterns
+
+### Reimplementing the discrimination
+
+Hook authors who grep `.bassclef-source.json` or hard-code install path lists duplicate the lib. Future rename events or new install writers break them silently.
+
+INSTEAD: source the lib. Compose with the shared discipline.
+
+### Skipping the lib for sister hooks
+
+Discipline hooks that fire on install-written content but don't consult the lib produce Kunal-pattern false fires on cold adopters.
+
+INSTEAD: add the consultation at the first opportunity. Per @luminary michael-feathers legacy-code retrofit — sister hooks consult the lib when next touched for other work.
+
+## Composes with
+
+- `.claude/rules/bootstrap-pair-discipline.md` — this rule + lib + schema + hook consumption + session-start fragment ship paired
+- `.claude/rules/state-schema-validation.md` — schema at `standards/state-spine/schemas/install-written-paths.schema.json` validates on write
+- `.claude/rules/we-dont-break-adopters.md` — additive; existing SKIP_* paths preserved
+- `.claude/rules/sibling-smoke-after-substrate-change.md` — post-merge sibling smoke confirms Kunal #8 cured end-to-end
+- @luminary linus-torvalds — adopter contract (manifest IS the adopter-visible surface this cure protects)
+- @luminary michael-feathers — characterization tests (lib tests pin actual install-vs-author discrimination)
+- @luminary john-ousterhout — deep module (narrow 5-verb interface hides schema + hash + I/O complexity)
+- @luminary michael-nygard — fail-soft (missing manifest, malformed JSON, missing hash tool → return "not install-written" + advisory to stderr)
+
+## Override path
+
+`SKIP_INSTALL_WRITTEN_PATHS=1` — the lib's `is_install_written_path` returns 1 (false) unconditionally when this env var is set. Hooks fire discipline normally. Logged via `trace_log`.
+
+INSTEAD of overriding routinely: trust the lib. Overrides are for one-shot debugging where the manifest-based path has misclassified.
+
+## V1 scope — this cure's PR
+
+- `lib/install-written-paths.sh` + Tier 0 tests
+- `standards/state-spine/schemas/install-written-paths.schema.json` + state-spine.md Shape C entry
+- `.claude/hooks/pre-commit-gate.sh` — lead-lens 3-marker gate section amended to consult the lib
+- `presence/install/bassclef-hook-connect.sh` — registers each path on write
+- `presence/install/bassclef-sync.template.sh` — registers each path on sync
+- `.claude/hooks/session-reflection.d/83-install-written-paths-rebuild.sh` — regenerates manifest when missing at session-start
+
+## Deferred to follow-on
+
+- `bassclef init` npm-side registration (lands in bassclef-cli; sources the lib via package symlink)
+- `pre-commit-identifier-leak-scrub.sh` consultation (sister hook adoption per Feathers legacy-code retrofit)
+- Any other hook that assumes author-edit — audit at next /architect-review

package/dist/lite/.claude/rules/lite-manifest-schema-change-discipline.md

@@ -36,11 +36,41 @@ When a PR changes the manifest schema OR output shape:
 3. **Downstream cure named** — the entry names what adopters need to do. If nothing (backward-compatible add), say so explicitly. If code change (like the v0.36.0 `upstream_commit` removal), name the pattern.
 4. **Release script pre-flight** — before every `/release`, the script reads the ledger and confirms an entry exists for the outgoing `manifest_version`. Missing entry BLOCKs the cascade.
 
+## Retirements
+
+Retirement-class changes (content-remove: a file previously shipped in the lite manifest gets deleted intentionally) ship with the same discipline shape as additions. Three paired artifacts, same PR:
+
+1. **Ledger entry** under this ledger's `## Entries` section naming the removed slugs, the deletion SHA, the version bump (MINOR per content-remove policy), and the downstream cure (what adopters at an exact pin do).
+2. **Allowlist row** in `.claude/hooks/tests/fixtures/2026-09-16-lite-catalog-closure/retired-entries.txt` naming each removed `<type>/<slug>` + `retired-in=<SHA>` + `reason=<one-line>`. The Feathers v1.6.1 snapshot guard (Test 16 in `.claude/hooks/tests/generate-lite-manifest.test.sh`) subtracts allowlist rows before asserting zero drops. Without the allowlist row the test fails and main CI goes red.
+3. **Discipline amendment** when a new retirement class surfaces that this section does not cover (e.g., tier retirement, field retirement). Extend this `## Retirements` section rather than author a new rule, per Ousterhout's complexity-is-incremental principle.
+
+When this rule fires on retirement:
+
+- Any PR that deletes a file listed in the current `lite-manifest.json` under `.entries[].path`
+- Any PR that retires a schema field that previously shipped as REQUIRED
+
+Skips (same as additions):
+
+- Content-only changes where the file stays but its content_hash shifts
+- Comment-only edits
+
+**Anchor luminaries for retirement:**
+
+- `@luminary linus-torvalds` — retirement of a tier-tagged adopter-observable file is a userspace break; the ledger + allowlist + release-step6 check ship in one PR
+- `@luminary hyrum-wright` — observable behavior becomes dependency with enough adopters; the 2 removed slugs were cited in rule bodies, sister docs, and the fixture snapshot; every retirement needs observable-surface enumeration first
+- `@luminary michael-nygard` — current ledger discipline for additions is methodology at author time; retirement needs the same mechanical floor plus a stability-pattern gate (release-step6 pre-flight)
+- `@luminary michael-feathers` — the fixture snapshot is the characterization test; allowlist is the author-time hook that keeps it green
+- `@luminary vaughn-vernon` — `retired-entries.txt` is the anticorruption layer between the frozen snapshot and the current manifest
+- `@luminary john-ousterhout` — contrarian: extend the existing rule with this section, do not author a new rule; the mechanical pre-commit hook (`pre-retire-discipline-check.sh`) is deferred to a follow-on PR so this one stays scope-tight
+
 ## Anti-patterns
 
 **Schema field added but no ledger entry.** Release script pre-flight BLOCKs.
 INSTEAD: add the entry in the same PR.
 
+**File removed from the lite manifest without an allowlist row + ledger entry.** Test 16 (Feathers v1.6.1 snapshot guard) sees the drop and main CI goes red at the next run.
+INSTEAD: append a row to `retired-entries.txt` naming `<type>/<slug>  retired-in=<SHA>  reason=<one-line>` AND add a `## Retirements`-aware entry to `standards/lite-manifest-schema-changes.md` in the same PR.
+
 **Ledger entry written but wrong version bump.** Adopters plan their pin update against the wrong version.
 INSTEAD: correct the bump before merge. AJV validation of the entry format catches inconsistency.